PaperlayerView exact revision on arXiv

Source-linked AI summary

The Handover Problem: Governing Autonomy Transitions in Human-AI Collaboration

Vicente Pelechano, Antoni Mestre, Manoli Albert, Miriam Gil

arXiv:2610.10352v1cs.AIcs.HC

TL;DR

Existing research traditions address parts of autonomy handover but lack a unified, auditable criterion for governing transitions across multi-cycle workflows. The paper formalizes the Handover Problem and combines a four-signal readiness score with hysteresis and hard guards. In controlled simulations, the HRS covers gradual deterioration that threshold guards miss, while guards address abrupt threshold breaches.

  • Problem

    Existing work addresses adaptive automation, trust, and deskilling separately, but lacks a temporal, multi-signal criterion for governing autonomy transitions across multi-cycle workflows.

    Source: §I · p. 1, §II · p. 2

  • Method

    The framework formalizes escalation, maintenance, and reversion as governance actions, combining a composite HRS with hysteresis and hard safety guards.

    Source: §I · p. 1, §VII · p. 9

  • Results

    In simulation, READINESS performs comparably to GOVERNANCE in steady state and covers gradual guard-silent deterioration; calibration eliminates 17 false escalations while preserving reversion coverage (50/50) and latency (3.0 cycles).

    Source: §V · p. 5, §VI · p. 9

  • Takeaways & Limitations

    Hard guards and the HRS address complementary failure regimes: guards respond to individual threshold breaches, while the HRS detects gradual multi-signal erosion.

    Source: §VI · p. 8, §VII · p. 9

    The results are from computational simulation with no human participants; non-circular validation requires human studies, and mapping observable signals to field instruments is a deployment prerequisite.

    Source: §V · p. 5, Threats to Validity · p. 9

Abstract

from arXiv · show

Human-machine systems rarely operate at a fixed level of AI autonomy. As operators and AI systems collaborate over time, control must shift: the AI can take on more responsibility when collaboration is stable, maintain its current role when evidence is ambiguous, or return control to the human when conditions deteriorate. Existing work on adaptive automation, supervisory control, trust in automation, and deskilling explains parts of this problem, but provides no auditable, multi-signal criterion for governing when autonomy should change across multi-cycle workflows. We formalise this challenge as the Handover Problem: deciding, at each operational cycle, whether to escalate, maintain, or revert AI autonomy while keeping the process reversible, recoverable, and auditable. We introduce the Handover Readiness Score (HRS), a transparent composite measure that integrates four signal dimensions: operator readiness, human-AI trust, learning stability, and operational performance. It is combined with a hysteresis-based transition policy that requires sustained positive evidence before increasing autonomy but reverts promptly when conditions worsen. Across software engineering and manufacturing domains, the HRS and hard safety guards address complementary failure regimes: guards enforce immediate corrective action when a single indicator breaches a critical threshold, while the HRS detects the slow, multi-signal erosion of operator readiness that no individual guard can observe. The framework establishes autonomy handover as a governance problem requiring explicit, composite, and auditable criteria. This provides a conceptual and formal foundation that adaptive automation research has not previously provided.

I. INTRODUCTION

The paper frames autonomy handover as a multi-cycle governance problem: existing research traditions address parts of it but lack a unified temporal criterion. It proposes an auditable criterion for reversible, recoverable transitions between collaboration modes.

I. INTRODUCTION

  • The framework combines a composite readiness score with reversible hysteresis and distinguishes slow, multi-signal erosion from abrupt threshold crossings.It is evaluated through controlled simulation across software engineering and manufacturing domains.Source: §I · p. 1
  • The Handover Problem requires governing escalation, maintenance, and reversion across cycles while preserving completeness, reversibility, auditability, balance, and recoverability.Recoverability means returned control remains useful, not merely returnable.Source: §I · p. 1

II. RELATED WORK

  • Prior work connects shared autonomy and adjustable automation to mode choice, while the HRS extends hybrid triggers to govern escalation and reversion with hysteresis and auditability.Parasuraman and Riley classify hybrid triggers as combining multiple signal types.Source: §II · pp. 1–2
  • Trust research documents overtrust and undertrust, motivating the paper’s treatment of reliance as a state to govern rather than a fixed input.Miscalibrated trust can lead people to accept automated recommendations that conflict with evidence.Source: §II · p. 2
  • Deskilling research links reduced control involvement to lower situation awareness and slower reversion, while agentic AI and oversight work highlight selective human intervention.The EU AI Act adds demand for auditable governance criteria in high-risk settings.Source: §II · p. 2
  • Shared autonomy, trust, and deskilling address separate dynamics, but no framework combines them as a temporal governance criterion across multi-cycle workflows.The paper identifies independent readiness dimensions: skill cannot compensate for deteriorating trust, and stable operations do not offset deskilling accumulation.Source: §I · p. 1, §II · p. 2

III. THE HANDOVER READINESS MODEL

The Handover Problem concerns choosing among collaboration modes as AI autonomy changes over bounded operational cycles. Its governance challenge is balancing immediate benefits of delegation against deferred deskilling costs.

A. Mode Spectrum and Handover Problem

  • The five collaboration modes are ordered by increasing AI autonomy, with COPILOT, PEER, and SUPERVISED as shared modes in which both agents execute task portions.An operational cycle is a bounded collaboration period.Source: Table I · p. 2, A. Mode Spectrum and Handover Problem · p. 2
  • Higher autonomy can improve speed, cost, and output consistency, but extended high-autonomy operation accumulates deskilling liability and may miscalibrate trust.A policy focused only on immediate performance risks fragility, while one focused only on deskilling risks underusing AI capability.Source: A. Mode Spectrum and Handover Problem · p. 2
  • The Handover Problem defines a policy that chooses ESCALATE, MAINTAIN, or REVERT at every cycle while satisfying completeness, reversibility, auditability, balance, and recoverability.Recoverability requires that returned control remain usable by the operator.Source: A. Mode Spectrum and Handover Problem · p. 2

B. The Handover Readiness Score

The Handover Readiness Score (HRS) combines four dimensions into an interpretable scalar for assessing whether autonomy should increase. Its components represent distinct reasons that readiness may be insufficient.

B. The Handover Readiness Score

  • HRSt = wH · Ht + wR · Rt + wL · Lt + wS · St combines human readiness, relational trust, learning stability, and operational stability.The weights sum to 1, and the score lies in [0, 1].Source: B. The Handover Readiness Score · p. 3
  • Human readiness Ht combines fatigue, skill, and deskilling exposure multiplicatively, so any severely degraded factor collapses the component.Ht carries recoverability by indicating whether returned control would remain usable; its weight is 0.35, the highest component weight.Source: B. The Handover Readiness Score · p. 3
  • Relational trust Rt is the normalized learned trust signal, but setting Rt = τt means higher trust always raises the composite, potentially rewarding escalation under overtrust.A hard guard at τt < 0.25 provides a separate trust floor.Source: B. The Handover Readiness Score · p. 3
  • Learning stability Lt assesses whether the skill trajectory has settled, using rolling task-quality variance over a five-cycle window.The supplied passages specify σ²max = 0.04 and a component weight wL = 0.20.Source: B. The Handover Readiness Score · p. 3
  • Operational stability St combines current KPI relative to its mode baseline with tenure in that mode; after a transition, its tenure contribution is zero.The resulting transient HRS dip cannot drive reversion unless the other three components are also weak; guards are unaffected.Source: B. The Handover Readiness Score · p. 3
  • Default weights are wH = 0.35, wR = 0.25, wL = 0.20, and wS = 0.20; they encode organisational priorities rather than fitted coefficients.The components are instantiated with observable proxies, including session length, competency assessments, override frequency, and KPI versus mode baseline.Source: B. The Handover Readiness Score · p. 3, Table II · p. 3

C. Hysteresis Policy and Hard Guards

The policy uses separate escalation and reversion thresholds, requiring sustained evidence before increasing autonomy while allowing immediate reversion. Hard guards override the composite score when critical conditions occur.

C. Hysteresis Policy and Hard Guards

  • The hysteresis policy escalates at HRSt ≥ τ↑ only after k↑ consecutive qualifying cycles, maintains between thresholds, and reverts at HRSt ≤ τ↓.Defaults are τ↑ = 0.72, τ↓ = 0.40, and k↑ = 3; deployment requires domain-specific recalibration.Source: C. Hysteresis Policy and Hard Guards · p. 3
  • Hard guards override the HRS and force immediate reversion when a critical fatigue, trust, deskilling, or failure-streak condition is met.The default failure-streak threshold is θf = 3 consecutive task failures and is domain-configurable.Source: C. Hysteresis Policy and Hard Guards · p. 4
  • The illustrative example reaches HRS = 0.544 ≤ τ↓ as skill erodes and deskilling exposure grows, although no individual guard observes the combined change.The example uses skill values 0.74 to 0.57 and deskilling exposure values 0.26 to 0.43.Source: C. Hysteresis Policy and Hard Guards · p. 4
  • The hypothetical 25-cycle episode illustrates delayed escalation, immediate HRS reversion after an AI error, and guard-triggered reversion after a fatigue spike.The full-model ablations, severity sweeps, sensitivity maps, and healthcare-boundary results are reported in the companion technical report.Source: C. Hysteresis Policy and Hard Guards · p. 4

IV. METHODOLOGY

The methodology evaluates HRS-governed autonomy transitions in computational simulations across software engineering, manufacturing, and healthcare, comparing governance conditions and testing gradual deterioration. It specifies the simulation dynamics, transition policies, and measures used to assess the hypotheses.

IV. METHODOLOGY

  • Model parameters are calibrated to qualitative literature benchmarks rather than fitted to the reported outcomes, so the evaluation tests whether HRS behaves coherently under assumed dynamics.The authors describe this as a computational precondition before field deployment.Source: §IV · p. 4
  • Episodes run for 100 cycles across three domains, with software engineering primary, manufacturing as replication, and healthcare mapping the regulatory boundary.A LINUCB allocator proposes collaboration modes, which the policy engine may override.Source: §IV · p. 4
  • Three conditions isolate governance effects: BASELINE uses an allocator without governance, GOVERNANCE adds caps and guards, and READINESS adds the HRS policy.The primary contrast is READINESS versus GOVERNANCE because both share the same cap-and-guard architecture.Source: §IV · p. 4
  • The gradual-deterioration protocol raises skill decay to 0.010 per cycle while keeping fatigue and deskilling below individual guard thresholds.The calibrated scenario is designed so the HRS is the only mechanism capable of detecting the drift over 40 cycles.Source: §IV · p. 5
  • Reversion uses τ↓ = 0.55 in the stress test, and the primary estimand is the share of seeds reaching majority human-led allocation during erosion.This threshold is above the default τ↓ = 0.40 and is explicitly a stress-test choice, not an operational default.Source: §IV · p. 5
  • The evaluation measures sustainability, deterioration response, and decision sensitivity through deskilling risk, reversion coverage and latency, and handover accuracy.The responsible score combines performance balance, shared-mode fraction, human retention, and autonomy restraint using design weights.Source: §IV · p. 5

V. RESULTS

The simulation results distinguish steady-state effects of the cap-and-guard layer from the HRS's contribution under gradual deterioration. In the guard-silent regime, READINESS detects deterioration that BASELINE and GOVERNANCE do not address.

V. RESULTS

  • In simulation, READINESS covers gradual deterioration in the guard-silent regime, where GOVERNANCE and BASELINE structurally cannot act.In normal operation, READINESS performs comparably to GOVERNANCE; no human participants were involved.Source: §V · p. 5, Table IV · p. 5
  • During normal operation, the cap-and-guard layer protects human sustainability without reducing performance, while READINESS remains comparable to GOVERNANCE.The table summarizes outcomes for all four hypotheses; its “directional” findings do not support statistical claims.Source: §V · p. 5, Table IV · p. 5
  • Under gradual deterioration, the HRS provides the distinctive coverage: READINESS acts where neither BASELINE nor GOVERNANCE has a mechanism to respond.All evidence comes from computational simulation.Source: §V · p. 5

A. Steady-State Performance and Sustainability (H1, H2)

In steady state, both governed conditions shift allocation away from autonomous operation without impairing task quality. The HRS adds no separate steady-state mode distribution or meaningful deskilling reduction beyond the guard layer.

A. Steady-State Performance and Sustainability (H1, H2)

  • Both governed conditions reduce AUTONOMOUS share from 63% to 42% and increase SUPERVISED share from 19% to 29%, with identical mode distributions for GOVERNANCE and READINESS.The redistribution is attributed to their shared cap-and-guard architecture, not the HRS.Source: A. Steady-State Performance and… · p. 5, Figure 2 · p. 6
  • Average task quality is 0.533–0.534 across conditions, while deskilling risk is 6.0% for BASELINE and 5.8% for GOVERNANCE.The reported steady-state deskilling improvement is attributed to the guard layer; the HRS adds no further meaningful gain at T = 100.Source: A. Steady-State Performance and… · p. 6, Table V · p. 6

B. Gradual Deterioration Detection (H3)

Under gradual sub-threshold deterioration, the HRS detects multi-signal erosion and triggers reversion even when no individual guard fires. Comparator results indicate that the composite sensor avoids false positives seen with a fatigue-only trigger.

B. Gradual Deterioration Detection (H3)

C. Component Ablation and Robustness

The ablation results distinguish acute shocks, where readiness alone retains coverage, from gradual erosion, where the full composite is needed. Sensitivity tests show reliable handover across a broad threshold region, while hysteresis stabilizes escalation without adding mode-change overhead.

C. Component Ablation and Robustness

  • Across TRUST-DROP, FATIGUE-SPIKE, and SUSTAINED-DEGRADATION, READINESS coverage was 50/50, 48/50, 50/50 versus GOVERNANCE's 1/50, 0/50, 0/50.The shocks directly perturb the human-readiness channel; Ht alone preserves most coverage on them, unlike gradual erosion with no-deterioration controls.Source: C. Component Ablation and Robustness · p. 7
  • Removing the hysteresis gap left reversion coverage unchanged; hysteresis instead prevents repeated mode changes near the escalation boundary.The policy requires three consecutive qualifying cycles before escalation.Source: C. Component Ablation and Robustness · p. 7
  • GOVERNANCE and READINESS had identical mean mode-change frequency per episode, so the HRS and hysteresis layer added zero overhead.The hysteresis gap prevents oscillation without suppressing necessary reversion.Source: C. Component Ablation and Robustness · p. 7

D. Sensitivity and Stability (H4)

  • 91% of valid threshold pairs fell in the stable region (HA ≥0.75), with mean HA 0.91 ± 0.10; over-aggressive τ↑≤0.50 yielded HA = 0.70.All tested τ↑≥0.55 achieved HA ≥0.75 across the full valid τ↓ range.Source: D. Sensitivity and Stability (H4) · p. 7, Figure 5 · p. 8
  • The default τ↑=0.72, τ↓=0.40 achieved HA = 0.85 inside the stable region; reducing wS from 0.20 to 0.10 instead dropped HA to 0.703.Perturbing wH, wR, or wL by ±0.10 left HA = 1.00.Source: D. Sensitivity and Stability (H4) · p. 8

VI. DISCUSSION

The discussion frames hard guards and the HRS as complementary layers for abrupt events and gradual multi-signal erosion, while identifying limits in compensation and deployment monitoring. A calibrated trust term eliminated false escalations in a silent degradation experiment, but the authors advise caution pending validation with real operator data.

VI. DISCUSSION

  • Guards respond to single-signal threshold crossings, while the HRS detects gradual multi-signal erosion; the framework requires both layers.Where structural constraints already enforce conservative modes, the HRS's marginal detection contribution diminishes and its value shifts toward auditability and recoverability.Source: §VI · p. 8
  • The HRS extends the hybrid-trigger concept to govern escalation and reversion, require sustained escalation evidence, and expose auditable component weights.It addresses when to change modes, complementary to Sheridan's taxonomy of which modes exist.Source: §VI · p. 8
  • In the subguard range, the additive HRS can still compensate for low readiness with other high components; hard guards backstop extreme conditions.A geometric-mean or min-based composite would remove this compensation at the cost of auditability.Source: §VI · p. 8
  • Continuous operator proxies create deployment duties: disclose signal collection, make demotions contestable, and guard against incentives to suppress legitimate overrides.The authors identify these as design constraints shaping signal collection, use, and record access.Source: §VI · p. 8
  • 17/50 seeds falsely escalated under original Rt during silent AI degradation; calibrated trust eliminated all 17, retaining 50/50 reversion coverage and 3.0-cycle latency.The experiment reduced AI quality to 50% for 40 cycles without triggering guards.Source: Table VIII · p. 9, §VI · p. 9
  • Until calibrated trust is validated against real operator data, use Rt = τt cautiously where AI overconfidence is plausible.The calibrated form is recommended for deployment based on the controlled degradation experiment.Source: §VI · p. 9

Threats to Validity

The paper identifies computational, measurement, and platform boundaries on its evidence, outlines a governed deployment pathway, and calls for human-participant validation. Its conclusion frames handover as a governance problem requiring composite, auditable criteria.

Threats to Validity

  • Internal validity remains limited because the evaluation cannot fully separate HRS effectiveness from adaptation to HAAS Studio; independent platform replication is needed.Source: Threats to Validity · p. 9
  • Trust, fatigue, and skill are modelled rather than measured in people, and the LinUCB baseline does not reproduce human decision-making under uncertainty.Source: Threats to Validity · p. 9
  • Observable signals proxy latent constructs, field-instrument mapping is a deployment prerequisite, and responsible_score requires human studies for non-circular validation.Source: Threats to Validity · p. 9
  • Human-participant validation is the stated next step, alongside adaptive weight learning, closed-loop stability analysis, and multi-operator handovers.Source: Threats to Validity · p. 9

Toward Deployment

  • Deployment proceeds through signal proxying, read-only shadow calibration, and governed go-live with conservative settings and inspectable weights.Source: Toward Deployment · p. 9

VII. CONCLUSION

  • The conclusion reports that, in controlled simulation, a composite readiness gate covers gradual multi-signal deterioration missed by threshold guards while preserving auditability.Source: §VII · p. 9

DATA AVAILABILITY STATEMENT

  • The deposit provides raw simulation outputs, supplementary material, and figure-generating scripts, with variable definitions in CODEBOOK.md.Source: DATA AVAILABILITY STATEMENT · p. 9

Related papers

Loading 2610.10352v1…